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The purpose of this research project was to develop a searchable database compiled with 
internal and external audit findings/observations. The data will correspond to the findings and 
observations from the date of Center-wide implementation of the ISO 9001-2000 standard to the 
present (2003-2008). It was derived and extracted from several sources and was in multiple 
formats. Once extracted, categorization of the findings/observations would be possible. The 
final data was mapped to the ISO 9001-2000 standard with the understanding that it will be 
displayed graphically. The data will be used to verify trends, associate risks, and establish 
timelines to identify strengths and weaknesses to determine areas of improvement in the 
Kennedy Space Center Business Management System Internal Audit Program. 

The project started with learning how the Business System functioned and how this office 
maintained and enforced the system to ensure both compliancy and efficiency. The Business 
Systems Process followed guidelines based loosely on the ISO 9000 standard, a system of 
international standards to ensure quality management. ISO 9000 requirements include a set of 
procedures to cover all key processes in the business, monitor processes to ensure they are 
effective, keep adequate records, check output for defects, with appropriate and corrective action 
where necessary, regularly review individual processes and the quality system itself for 
effectiveness, and facilitate continual improvement. The Business System at Kennedy Space 
Center is responsible for maintaining Kennedy documents and requirements, the OFI system, 
performance metrics, and internal audits to ensure compliancy to the Business Systems process. 
The support analysis provided was to develop a way to analyze the quality system itself for 
effectiveness by creating a database incorporating audit report findings and OFIs, and using trend 
analysis and risk assessment on the data gathered. 

Our first task in completing this project was to plan and outline a structure for the 
database. The database was created using Microsoft Office Access, an application utilizing 
relational tables. The first task involved planning the database in order to determine a list of 
tables that might be used and fields to populate these tables. Four tables were eventually created: 
Audit Report, Audit Report Findings, Contact Information, and OFIs. These tables were linked 
by several common fields, creating a relational database which allows a user to pull information 
on several records at one time. The Audit Report table contained the fields: Audit Number, 
Auditor Last Name, Directorate, Directorate POC, Date of Audit, Duration, Fiscal Year, 

Potential Non-Conformances, Non-Conformances, Total # of Findings, Data Report Issued, # 
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Days to Release Report, and Executive Summary. These tables contained summary information 
on the Audit Reports, with more in-depth information such as the specific finding and 
observation in the table Audit Report Findings. Headings for this table included Audit Number, 
Potential Non-Conformance, Non-Conformance, OFI Number, ISO Clause, ISO Standard, 
Document(s) #, and Finding Statement. The Audit Number field is repeated in both tables in 
order to create a relational field so the data can be linked together. The contact information field 
was created in order to display the Name, Phone #, and E-mail of the lead auditor for that Audit 
Report. The contact information table was related to the Audit Report Table via the name column 
for the lead auditor. 

The OFI Table was not created for this project, but is part of the OFI Database that 
contains information for all OFIs issued for Kennedy Space Center. OFIs stand for Opportunity 
for Improvement, a service available for civil servants and contractors to suggest ways to 
improve NASA operations. Audit Reports that usually result in non-conformances are 
accompanied by OFIs. Once an OFI is issued, the Directorate must take certain actions to resolve 
and close the OFI; including finding a root cause and issuing a corrective action plan (CAP). 

This table was linked from the OFI Database in order to provide the user of the Audit Report 
Database with information about the OFI issued in response to Audit Report Non-conformances. 
The OFI table can also be used to analyze metrics, including the amount of time taken for each 
step and the total number of days taken to process each one. With the OFI metrics, we can 
determine whether the OFIs issued in accordance with Audit Reports are taking shorter or longer 
to process than normal OFIs, again, helping to determine the effectiveness of the Business 
System Process. 

Once the database was planned out and the tables and fields created, the crux of the 
project began, entering the Audit Report Data into the database. Information from Audit Reports 
from 2003 to 2008 were added and categorized, based on the fields created. Audit Reports 
usually involved three different files, the plan, checklist, and final report. The plan outlined 
summary information for the upcoming audit and provided a general overview of what would be 
audited. The checklist is filled out by the lead auditor and documents the non-conformances and 
potential non-conformances for each ISO Standard. When the field audit is finished, the lead 
auditor submits the checklist to the Business Systems Branch to compile the final report that will 
be sent to the Directorate. The Directorate must then take any necessary action that is a result of 
the Audit Report. 

The database created incorporated parts of all three documents. These documents were 
usually written as Word files, so extracting and compiling the information became an arduous 
process. The Business Systems Branch works to conduct an audit of each Directorate every 1 8 
months, which results in a total of 12 audits per year. The total time period involved in the 
project was 6 years, from 2003-2008. The internal audit findings were combined with external 
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audit findings from the NQA, an organization that verifies ISO compliance and issues 
recertification. 

Once the audit report information was compiled into the database, I began creating 
macros and forms to make the database more user-friendly. The goal of this database is to not 
only analyze past data, but also make it convenient and accessible for future users. I want to 
eliminate unnecessary data entry, including making both a Word file of the audit report and then 
entering the information into a database. With this goal in mind, the job is not only entering the 
findings/observations into a database so it can be analyzed, but also making it user friendly. The 
database should reflect past data, but also anticipate future problems that might arise when 
inputting the data. 

A macro is a set of computer instructions that can be recorded and associated with a 
shortcut key combination or a macro name. Then, when the shortcut key combination is pressed, 
the computer program carries out the instructions of the macro. Macros help add functionality 
and programmability to the database, making it easier to use for someone who is not intimately 
familiar with Microsoft Access. Forms, like macros, add functionality to the database, by 
simplifying the process of inputting data. For this database, I created five forms, one for each 
table, and a fifth for the switchboard. The forms contain the same information and headings as 
the tables, but are organized in a more user-friendly manner. They also contain macros to 
automate the adding of information, and ensure that few to no mistakes are made by the user. A 
switchboard is a type of form that contains buttons or links that enables the user to navigate 
around the database. The switchboard appears when the user first opens the database, and makes 
navigating around the tables and forms easier for someone not familiar with Access. 

After creating the forms and macros, analysis on the findings could begin. The analysis 
was intended to incorporate both trend reports and risk assessment. However, after creating the 
database, we soon realized risk assessment would probably not be possible due to the difficulties 
in assigning risk values to different findings and standardizing them. In order to create trend 
reports, I was first required to create queries. Queries are applications in Microsoft Access that 
allow the user to filter and find specific information. Once this information is found, it can be 
compiled into graphs or charts. These graphs can then be filtered and changed based on table 
headings, allowing the user to create detailed trends by only viewing certain information. The 
queries created for this database include: Findings over Time, Findings per Fiscal Year, Findings 
per ISO Standard, ISO Standard Violations, Number of OFIs Issued, OFI Metrics, PDCA 
Trends, Root Cause Reject Rate, and Status of OFIs. These trends incorporate both Audit Report 
metrics and OFI metrics in order to provide comprehensive findings. 

One of the last aspects of the database created was the report application. The report 
application in Microsoft Access eliminates the need to create manual Word files by incorporating 
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the information compiled in the database into a way specified by the user. Once this report is 
created for one audit finding, it can be saved and created automatically for each subsequent 
finding. 

This project resulted in a database that will help the Business Systems analyze their 
processes to ensure the quality and efficiency of their system. Contributing members to this 
project included my mentor and Business System Analyst, Mrs. Delia Markham, my co-intem, 
Justin Birbal, the Audit Program Manager, Ken Young, the Business System Manager, Michael 
Bell, and the Continual Improvement Specialist and OFI Analyst, Donna Lozaw. 
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